State Of GDPR In 2021: Key Updates And What They Mean — Smashing Magazine

GDPR: Where the Regulation Stands Now

Few regulations have reshaped digital work as thoroughly as the EU's General Data Protection Regulation. Since it took effect on 25 May 2018, the law has influenced how products are designed, how data moves between organizations, and how international transfer agreements are structured. Its reach extends far beyond Europe: a web agency in Wisconsin and a marketing team in Malta both build with GDPR constraints in mind.

Technology's influence now rivals natural forces, as digital futurist Kevin Kelly has argued, and the friction between governments and tech platforms proves the point. Recent clashes — such as Facebook blocking news for Australian users after the government moved to force platform owners to pay publishers — show how quickly policy and product decisions collide. Add earlier controversies like the Cambridge Analytica scandal and the U.S. Capitol riot organizing, and it's clear the regulatory landscape is still settling.

Below we cover the key updates since 2018, the broader interpretation of “joint controller,” and what it all means for designers, developers, and companies inside and outside the EU. A follow-up piece will examine cookie consent and the tension between marketing's reliance on Google Analytics data and GDPR compliance, then explore first-party ad tracking as third-party cookies fade.

Recap: The Seven Principles

The GDPR rests on seven core principles that define how personal data must be handled:

1. Lawfulness, fairness and transparency. Processing must be understandable to the people whose data is used — what data, how it's used, and why.
2. Purpose limitation. Data may only be collected for clear, specified, legitimate purposes, and not processed incompatibly with those original purposes.
3. Data minimization. Collect only what you actually need.
4. Accuracy. Data must be correct and current; inaccurate records should be erased or fixed.
5. Storage limitation. Identifiable data may be kept only as long as needed for the stated purposes, with exceptions for research use.
6. Integrity and confidentiality. Personal data must be processed securely, protected from unauthorized or unlawful handling, accidental loss, destruction, or damage.
7. Accountability. You are responsible for the data you hold and must demonstrate compliance.

Some terminology helps ground the discussion:

• CJEU — Court of Justice of the European Union; its rulings clarify EU laws including GDPR.
• DPAs — National Data Protection Authorities; each EU country has one. They enforce GDPR and issue fines at the national level. The UK equivalent is the Information Commissioner's Office (ICO). In the U.S., similar privacy rules are largely state-level.
• European Commission — the EU's executive body; it drafts legislation including the GDPR.
• GDPR — The 2018 General Data Protection Regulation.

Implementation Status and the EU's Priorities

The European Commission reports that GDPR is nearly fully implemented across member states, though some — Slovenia is named — have lagged. The EU believes member countries are using their new enforcement powers fairly, but it voices concern about divergence and fragmentation. GDPR works effectively only if member states stay aligned; fragmented national laws muddy the single market.

The EU's stated priorities for the regulation's evolution include making it easier for individuals to exercise their rights, pushing cross-border collaboration and class-action lawsuits, and expanding data portability beyond banking and telecoms. For smaller organizations, the EU wants to ease compliance burdens — likely via support tools and additional standard contractual clauses, templated legal language SMEs can reuse. The EU shows no appetite for loosening the rules for smaller firms.

Development: A Broad ‘Joint Controller’ Definition

The most consequential shift since 2018 comes from two CJEU cases involving Facebook. The court defined “joint controller” much more broadly than many expected, with direct consequences for publishers, website operators, and social page administrators.

In a joint controller arrangement, two or more entities share responsibility for GDPR compliance. The practical meaning:

• You and your fellow controllers decide together how each step of processing will comply.
• Each controller bears full responsibility for the entire process and is accountable to the relevant data protection authority.
• Individuals can file complaints against any or all joint controllers.
• All are liable for damages unless they can prove no connection to the harmful event.
• An individual can seek compensation from any controller; you might recover a share from co-controllers.

The first case ruled that a company operating a Facebook fan page acts as joint controller alongside Facebook. The second extended this: embedding Facebook's Like button on your website makes you a joint controller with the social network. The rulings unsettled the privacy community, since they make social publishers, site operators, and page moderators responsible for user data alongside the platform itself.

Still, the CJEU clarified that shared responsibility is not equal responsibility. In both cases, Facebook held primary responsibility — only Facebook had access to the data and only Facebook could delete it. That softens the practical impact, but the legal exposure remains significant.

Some sites have already responded by blocking embedded social content by default, requiring explicit opt-in. Germany's 2020 EU presidency website demonstrated this pattern:

Privacy Shield Falls, California Raises the Bar

The second major shift of 2020 was the end of Privacy Shield, the framework that let US companies process EU customer data after agreeing to higher privacy standards. The EU and US developed it because their data-privacy philosophies are fundamentally opposed: Europe treats personal data as private unless the user grants explicit permission, while America treats it as public unless the user opts out. Yet the world's two largest consumer markets still need to trade.

Austrian privacy advocate Max Schrems challenged the arrangement on the grounds that US law still allowed the government to monitor the transferred data. The Court of Justice of the European Union sided with him and struck Privacy Shield down, leaving the roughly 5,300 American SMEs that relied on it to fall back on the EU's Standard Contractual Clauses. A replacement is expected, but experts predict it will face the same legal fate, since the transatlantic approaches to privacy remain essentially incompatible.

Meanwhile, California strengthened its own GDPR-inspired law. The California Consumer Privacy Act (CCPA), in effect since January 2020, gives state residents the right to opt out of having their data sold, to request disclosure of collected data, and to ask for deletion. It applies only to commercial companies that either process data on more than 50,000 California residents a year, generate over $25 million in annual gross revenue, or earn more than half their revenue from selling residents' personal data.

The California Privacy Rights Act (CPRA), which takes effect in January 2023, extends those protections further:

• It raises the applicability threshold to companies processing data on 100,000 California residents a year.
• It adds specific protection for sensitive data such as race, religion, sexual orientation, health information and government IDs.
• It triples fines for violations involving minors' data.
• It grants residents the right to request correction of their data.
• It requires companies to assist with CPRA investigations and creates a dedicated California Privacy Protection Agency for enforcement.

Privacy legislation is also advancing in other states, and the combined pressure may push the Biden administration toward a federal privacy law.

Tighter Rules on Cookies

In May 2020, the European Data Protection Board updated its GDPR guidance on consent. Two points matter most for cookie consent:

• Cookie walls are disallowed because blocking content for users who reject cookies removes genuine choice.
• Scrolling or swiping through content does not count as implied consent. Consent must be explicit.

Big Tech Faces Antitrust and Enforcement Action

As Google and Apple position themselves for a post-third-party-tracking world, both have drawn antitrust complaints from adtech companies and publishers who argue the platforms are exploiting their dominant market positions. At the same time, the first major GDPR fines have landed:

• France's data regulator fined Google €50 million for a lack of transparency, inadequate information and invalid consent in ads personalization. Users were not sufficiently informed about how and why their data was collected.
• The UK's ICO fined Marriott International £18.4 million for failing to secure 339 million guest records. The breach occurred in a 2014 cyber-attack on Starwood Hotels, which Marriott acquired in 2016, but was not discovered until 2018.
• The same UK regulator fined British Airways £20 million over a 2018 breach exposing 400,000 customers' personal and credit card data.
• H&M received a €35 million penalty over an employee data breach that drew particular criticism for its violation of employee trust.

What Practitioners Should Take Away

GDPR affects designers because they build the interfaces where users share data and decide what gets collected and how it is processed. Follow Privacy by Design practices and reuse proven patterns such as compliant cookie banners rather than reinventing them. Coordinate with compliance and development teams so designs are both compliant and implementable, collect only what is needed, and ask users what data they are comfortable sharing.

Developers enable the actual data processing, sharing and integrations, so their role is equally central. Treat GDPR as a need-to-access model: start with everything locked down and grant access only when required, then audit and document continuously. Apply privacy and security by design principles with robust templates for infrastructure, and get involved early in conversations about cookie consent and tracking so decisions are technically feasible. Process mapping reveals where data flows through the business, automation reduces human error and prevents unauthorized access, and GDPR checklists or run books keep the process manageable.

Where GDPR Is Heading

EU Implementation and Enforcement

The EU is pressing member states to neither water down nor exceed GDPR, since alignment makes cross-border cases and international collaboration easier. In exchange, Brussels will enforce compliance, facilitate class actions and cheaper cross-border suits, and promote privacy standards beyond its borders. Additional SME support and possible certification for security and privacy by design are on the table. More notably for Silicon Valley, the Commission has hinted it may consider outright bans on data processing as a compliance lever — a prospect that matters far more to deep-pocketed firms than the €50 million fines that have so far been issued.

Innovation and Sensitive Data

GDPR was designed to be technology-neutral, and the EU points to the rapid rollout of COVID-19 tracking apps as evidence that the framework does not block progress. Expect codes of conduct for sensitive data categories such as health and scientific research. At the same time, regulators are watching emerging areas closely, with particular concern about video, IoT, blockchain, facial recognition and AI developments. The Commission has singled out "multinational technology companies," "large digital platforms" and online advertising and micro-targeting as focus points.

Exporting GDPR Standards

The EU's influence now extends well beyond its borders, both through compliance obligations and through its role as a template for new laws. California's CCPA and Brazil's LGPD are the most visible examples, with Canada, Australia, India and several US states also moving. Brussels is actively promoting its approach through several channels:

• Mutual adequacy decisions with Japan and soon South Korea.
• Privacy clauses embedded in trade agreements with New Zealand, Australia and the UK.
• Participation in OECD, ASEAN, G7 and G20 discussions.
• Its Data Protection Academy for EU and international regulators.

The EU's priorities are trusted data flows that encourage innovation and closer cooperation between law enforcement and private operators. For companies operating in the EU, the practical requirement is straightforward if demanding: demonstrate compliance with GDPR's seven principles and follow guidance from the relevant national Data Protection Authority, or face increasingly substantial penalties.

GDPR Beyond the EU: What Non-European Companies Face

If your company sits outside the EU but processes personal data from people inside it, GDPR applies to you as strictly as it does to any European business. The regulation follows the data subject, not the company headquarters. Selling to EU customers means handling their data under GDPR rules, or risking fines in the same league as those levied on Facebook and Google.

Enforcement follows a predictable path. Multinationals with European assets could see those assets seized over unpaid fines. Companies without an EU presence must appoint a representative in the EU through whom penalties are channelled, unless they prefer the cost and complexity of an international lawsuit.

The picture gets messier when your customer base spans jurisdictions. An EU customer and a California customer may both be protected, but by different rules. GDPR demands active consent before placing any non-essential cookie on a device. The CCPA, by contrast, requires you to disclose collection practices and offer an opt-out from data sales — no affirmative consent needed. Compliance with both means reconciling these mismatches, which explains the EU’s push for international standards that would ease the burden of simultaneous compliance.

One pragmatic note for US-based firms: rather than waiting on a Privacy Shield successor, companies like Microsoft have stated they intend to comply with GDPR directly, not relying on bilateral data-transfer mechanisms.

Six Lessons for Designers and Developers

Privacy regulation is now a permanent fixture, reshaping how customer data is handled. Here are key takeaways for engineering teams.

1. Compliance is now a long haul.
   The initial rush to meet the 2018 deadline is over, but GDPR continues to shift alongside the technologies it regulates. Similar—but not identical—laws are emerging worldwide, so the compliance demands on your workflows will keep moving.
2. Privacy is a differentiator.
   The headline fines get the press, but reputational damage from breaches often hurts more. Embedding GDPR into your design and development process early makes your team more resilient as rules evolve.
3. User-centred design ties compliance to resilience.
   Companies that had invested in digital transformation coped better with the pandemic. The same customer-first focus underpins GDPR-aligned product design: treat data as precious, and your products will adapt more readily to future legal shifts.
4. Compliance can be architected into products.
   Privacy by design is non-negotiable. Service blueprints should map where data is collected, processed and stored, exposing weak points before they become breach points. Automated compliance tooling lightens the operational load and can improve security at the same time.
5. GDPR does not block innovation; it redirects it.
   Some argue that restraining data flows suffocates progress, but secure innovation in blockchain, IoT and AI is achievable. The key is ethics: design that respects customers and their data, not just technical capability.
6. Third-party liability is now your problem.
   Joint-controller rulings mean you share responsibility for any third party processing your customers’ data. Expect tighter contractual obligations and continuous monitoring of partners as a standard practice.

Where GDPR Is Headed

The coming years will likely bring several predictable developments:

1. The regulation will keep evolving, refined by case law and possibly by the long-awaited ePrivacy Regulation.
2. The EU will keep pressing for global adoption of data-protection norms, often folded into trade and security agreements.
3. Convergence of privacy laws may arrive—more likely if the US enacts federal data-privacy legislation.
4. Disputes between the EU’s privacy-first stance and the US’s permissive commercial data model will intensify.
5. Users may increasingly accept data-for-service exchanges, including cookie-based tracking, as an explicit value trade.
6. Businesses will pivot from third-party cookies toward server-side tracking and automation that keeps them on the right side of consent rules.
7. Privacy by Design and service-design methodologies will become standard tools for managing overlapping obligations.
8. Privacy litigation will grow in size and frequency—one certainty is that it will be profitable for lawyers, whatever the outcome for tech giants.

Trust as the Operating Principle

Whether you read European Commission guidance or expert commentary, the recurring word is trust. Clients now expect evidence of data security and compliance infrastructure—including staff training policies—before they engage. The EU’s strategy is to enable safe data flow and innovation through standard-setting, rather than simply punishing breaches. Designers and developers are the ones who turn that regulatory intent into working products, which makes their role central to what comes next.